[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

automated key-establishment schemes. | Algorithm                           | A clearly specified mathematical process for computation; a set of rules that, if followed, will give a prescribed result.
|
|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Approved                            | FIPS- approved or NIST-Recommended. An algorithm or technique that is either 1) specified in a FIPS or NIST Recommendation, or 2) adopted in a FIPS or NIST Recommendation and specified either (a) in an appendix to the FIPS or NIST Recommendation, or (b) in a document referenced by the FIPS or NIST Recommendation. |
| Assumption                          | Used to indicate the conditions that are required to be true when an approved key-establishment scheme is executed in accordance with this Recommendation. |
| Assurance of private-key possession | Confidence that an entity possesses a private key corresponding to a public key. |
| Assurance of validity               | Confidence that either a key or a set of domain parameters is arithmetically correct. |
| Big-endian                          | The property of a byte string having its bytes positioned in order of decreasing significance.

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems:

xamples of configuration actions to implement the guideline
- o The examples are described at a high level as the process to implement the guideline will vary by manufacturer and smart-inverter model.
Consult the manufacturer's documentation for specific instructions.

Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations:

Introduction_______________________________________________________1 | |---------------------------------------------------------------------------|---------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------| | | 1.1 | Scope | ______________________________________________________________2 | | | 1.2 | Audience | ____________________________________________________________3 | | | 1.3 | Background and Rationale | ______________________________________________3 | | | 1.4 | Organization _________________________________________________________4 | | | | 1.5 | Glossary of Terms and Acronyms_________________________________________5 | | | | | 1.5.1 Glossary_____________________________________________________________ | 5 | | | | 1.5.2 Acronyms___________________________________________________________ | 19 | | 2 | Key-Management Concepts_________________________________________21 | Key-Management Concepts_________________________________________21 | | | | 2.1 | Key Establishment____________________________________________________21 | | | | 2.2 | Key-Management Functions | ____________________________________________21 | | | 2.3 | Cryptographic Key Management Systems (CKMS) | __________________________22 | | | | 2.3.1 Central Oversight Authority | _____________________________________________ 23 | | | | 2.3.2 Key-Processing Facility(ies) | ____________________________________________ 23 | | | | 2.3.3 Service Agents_______________________________________________________ | 25 | | | | 2.3.4 Client Nodes | ________________________________________________________ 25 | | | | 2.3.5 Tokens _____________________________________________________________ | 26 | | | | 2.3.6 Public Key Infrastructure Environments ___________________________________ | 26 | | | | 2.3.7 Symmetric Key Environments | ___________________________________________ 26 | | | | 2.3.8 Hierarchies and Meshes _______________________________________________ | 27 | | | | Centralized vs.

Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The NIST Risk Management Framework (RMF), described in NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, is a methodology for implementing risk management at the information systems tier. The RMF (depicted in Figure 2) identifies six distinct steps that provide a disciplined and structured process to integrate information security risk management activities into the system development life cycle. The RMF addresses security concerns of organizations related to the design, development, implementation, operation, and disposal of information systems and the environments in which those systems operate.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.5 (NIST 3.3.5)?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

3.3.5, 3. 3.3.5                             |
| with related policies, PR. 3.3.5                             |
| with related policies, PR.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Architecture Design Process for Health Information Exchanges (HIEs) provide? (Part 2)

[Assistant]
| EXECUTIVE SUMMARY..................................................................................................
| 1                                                                                |
|------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2.0                                                                                | INTRODUCTION ................................................................................................................ 1                                                                                | INTRODUCTION ................................................................................................................

Security Architecture Design Process for Health Information Exchanges (HIEs)

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.12. Requirements for Visual Facial Image Comparison . . . . . . . . . . . .

transcription, or accessibility support) to assist the applicant in the identity
proofing process but does not support decision-making or risk-based evaluation.

13. The CSP’s policy for assessing customer experience, including the testing methods
employed, timing of its periodic reviews, and any specific conditions that will
trigger an out-of-cycle review (see Sec. 3.4)

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to 2017 NIST_ITL Cybersecurity Program Annual Report:

- NIST improved two widely used guidelines that provide senior leaders with the information they need to make risk-based decisions affecting critical mission and business functions. We proposed revisions to Security and Privacy Controls for Information Systems and Organizations (Special Publication (SP) 800-53) and Risk Management Framework for Information Systems and Organizations (SP 800-37). The latter provides a closer link between risk management processes and activities at various organizational levels. It demonstrates how the Cybersecurity Framework can be implemented using established Risk Management Framework processes. Both publications will be finalized in 2018. - Reflecting a growing recognition of the link between cybersecurity and privacy risk management, we collaborated with internal and external partners to integrate privacy requirements and considerations into SP 800-53 and SP 800-37 risk management guidelines as well as our latest version of NIST's Digital Identity Guidelines (SP 800-63-3), which covers digital identity from the initial risk assessment to the deployment of federated identity solutions. These guidelines build the foundation needed to make privacy and security equal, quality attributes in trustworthy systems. We focused on encouraging the adoption of trusted identities through digital identity standards for federal agencies and internationally. - The supply chain that provides the information and operational technology (IT/OT) upon which we all depend has evolved into a complex, globally distributed, dynamic ecosystem enabling the development of highly refined, sophisticated, cost-effective, and reusable solutions. In FY 2017, we published a proposed process model providing a method to identify and prioritize IT/OT systems and components.

2017 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Random Bit Generator (RBG) Constructions provide? (Part 4)

[Assistant]
nisms based on cryptographic algorithms. SP 800-90B, Recommendation for the Entropy Sources Used for Random Bit Generation ,  provides guidelines for the development and validation of entropy sources.
This document (SP 800-90C) specifies  constructions  for  the  implementation  of  random  bit  generators  (RBGs)  that  include DRBG mechanisms as specified in SP 800-90A and that use entropy sources as specified in SP 80090B. Constructions for four classes of RBGs - namely, RBG1, RBG2, RBG3, and RBGC - are specified in this document. ## Keywords

deterministic  random  bit  generator  (DRBG);  entropy;  entropy  source;  random  bit  generator (RBG);  randomness  source;  RBG1  construction;  RBG2  construction;  RBG3  construction;  RBGC construction; subordinate DRBG (sub-DRBG). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal  information  systems. The  Special  Publication  800-series  reports  on  ITL's  research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Note to Readers

1.

Recommendation for Random Bit Generator (RBG) Constructions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Hardware Security Failure Scenarios_ Potential Hardware Weaknesses provide? (Part 4)

[Assistant]
osure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| 1. Introduction...................................................................................................................................6   |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Background....................................................................................................................................7    |
| 2.4.1. Hardware Design View .................................................................................................................8        |
| 2.4.2. Research Concepts View ..............................................................................................................9         |
| 2.4.3. Simplified Mapping of Published Vulnerabilities View.................................................................9                         |
| 3. Technical Approach......................................................................................................................10         |
| 3.1.1.

Hardware Security Failure Scenarios_ Potential Hardware Weaknesses


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guide to SSL VPNs:

ications on the intranet servers from organization-managed hosts. An organization-managed host has a firewall, antivirus software, and a registry key indicating that it is managed by the organization.
-  When these same users log in from any other host such as a PC at a kiosk or in an Internet café, they should be able to access only a limited set of Web-based applications such as email and calendaring. The only condition for any host is that, if it is running a Windows operating system, it must be using one or more specific versions of Windows, with each specific version using the most current set of updates. -  Executives have the same access rights as other employees, as well as access to the executive file share on the administrative server. The executives are only given this access from organizationmanaged hosts. -  Members of the sales group have the same access rights as other employees. In addition, they should have full access to the sales database and the sales file share on the sales server when they are using their own organization-managed hosts; from other hosts, they can only access the sales file share on the sales folder. -  Business partners should be able to access the extranet partner server from specified IP addresses only Monday to Friday between 9 a.m. and 5 p.m. Eastern time. -  In addition to all other resources, network administrators should have access to a range of subnets that are assigned to network infrastructure devices. They only have this access if they are using their organization-managed hosts.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

| DTR No:         | DTR Description                                                                                | Spec. Reference                                       |
|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------|
|                 | PKCS #1 v1.5 padding, the signatureAlgorithm field shall specify the rsaEncryption OID (as per Section 3.2 of [RFC3370]), and for ECDSA and RSA with PSS padding, the signatureAlgorithm shall be in accordance with Table 3-3 of [SP800-78]. | Security Object                                       |
| DTR-07.02.01.11 | The SignedData content type shall include the digital signature. | • [SP800-73], Part 1, Section 3.1.7 - Security Object |

| DTR No:         | DTR Description                                                                                | Spec.

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Computer Security Division 2003 Annual Report:

What do a business's invoices have in common with  email?  If  the  business  does  both  on  the same computer, they  may  want  to  think  more about  computer  security. Payroll, proprietary information, client or employee data - information  is  essential  to  a  business's  success. A computer failure or other system breach could cost a business anything from its reputation to its  competitive  advantage. The small business owner who recognizes the threat of  computer crime  and  who  takes  steps  to  deter  inappropriate activities is less likely to become a victim.

The vulnerability of any one small business may not  seem  significant  to  many  other  than  the owner and employees. However, over 95 percent of  all  U.S. businesses  are  small  and  mediumsized  businesses  (SMBs)  of  500  employees  or less. Therefore a vulnerability common to a large percentage of all SMBs could pose a threat to the Nation's economic base. In the special arena of  information  security, vulnerable  SMBs  also run  the  risk  of  being  compromised  for  use  in crimes against governmental or large industrial systems  upon  which  everyone  relies. SMBs cannot  always  justify  an  extensive  security program, or  often  a  single  full  time  expert. Nonetheless, they confront serious security challenges and must address security requirements based on identified needs.

The  difficulty  for  these  organizations  is  to identify  needed/cost-effective  security  mechanisms and obtain training that is practical and cost effective. Such organizations also need to become more educated consumers in terms of security, so that their limited security resources are well applied to meet the most obvious and serious threats.

Computer Security Division 2003 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories:

Management Training and Employment | Citizens] D.14 Health Access to Care Population Health Mgmt &Consumer Safety Health Care Administration Health Care Delivery Services Health Care Research and Practitioner Education D.15 Income Security General Retirement and Disability Unemployment Compensation Housing Assistance Food and Nutrition Assistance Survivor Compensation D.16 Law Enforcement Criminal Apprehension Criminal Investigation and Surveillance Citizen Protection Leadership Protection Property Protection Substance Control Crime Prevention Trade Law Enforcement D.17 Litigation &Judicial Activities Judicial Hearings Legal Defense Legal Investigation Legal Prosecution and Litigation Resolution Facilitation D.18 Federal Correctional Activities Criminal Incarceration Criminal Rehabilitation D.19 General Sciences &Innovation |

Guide for Mapping Types of Information and Information Systems to Security Categories


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy.

The criteria for whether a security control is assurance- or functionality-related is based on the overall characteristics of the control. In general, assurance-related controls are controls that: (i) define processes, procedures, techniques, or methodologies for designing and developing information systems and system components; (ii) provide supporting operational processes including improving the quality of systems, components, or processes; (iii) produce security evidence from developmental or operational activities; (iv) determine security control effectiveness or risk; or (v) improve personnel skills, expertise, and understanding.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.9 (NIST 3.1.9)?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

3.1.9                                                                                | Insecure Images, Software and Firmware... 3.1.9 Insecure Images, Software and Firmware

Adversaries may attempt to interfere with a storage device's software distribution, update, or installation process in order to introduce incorrect, outdated, or maliciously modified code (e.

Security Guidelines for Storage Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.11 (NIST 3.1.11)?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

3.1.11 RSA Exponent

| Test Assertion       | TA-09.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to A Formal Description of the SDNS Security Protocol at Layer 4 (SP4):

3.2.1 SP4E External to Transport

The choice of modeling SP4E external to and independent from Transport introduces some limitations on the protection operations performed.

A Formal Description of the SDNS Security Protocol at Layer 4 (SP4)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Prioritizing Cybersecurity Risk for Enterprise Risk Management:

| | Current Risk Analysis | Current Risk Analysis | Current Risk Analysis | | Likelihood before controls (%): 10% | Impact before controls ($): $1,500,000 | Exposure Rating before controls ($): $150,000 | | Planned Risk Response | Select all that apply: ☐ Accept ☐ Avoid | Transfer ☐ Mitigate | | Planned Risk Response Description | Add additional coverage to enterprise disaster recovery policy to ensure the direct losses caused by customer communication disruption from a covered event.

Prioritizing Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Zero Trust Architecture:

3.2.4                                                                                | Entorno de pruebas (sandbox) para aplicaciones en dispositivos... 3.2.4 Entorno de pruebas ( sandbox ) para aplicaciones en dispositivos

Otra variación del modelo de despliegue de agente y puerta de enlace es hacer que las aplicaciones o procesos examinados se ejecuten en compartimentos independientes dentro de los activos.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

Standards and Technology, Interfaces for Personal Identity Verification , NIST Special Publication (SP) 800-73-4, May 2015 (includes updates as of 2/8/16). http://dx.doi.org/10.6028/NIST.SP.800-73-4.
- [SP800-78] National Institute of Standards and Technology, Cryptographic Algorithms and Key Sizes for Personal Identity Verification , NIST Special Publication (SP) 800-78-4, May 2015. http://dx.doi.org/10.6028/NIST.SP.800-78-4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture:

ey can hide software. By decoupling operating system dependencies from the host system, a container image may contain unknown vulnerable or insecure software, which poses a software supply chain risk.
Additionally, container contents may not be observable by some security auditing tools. In a well-managed HPC system, most software has already been installed as a baseline system environment. The applications developed using native libraries often run faster than a container. Hence, training users to develop programs in the HPC programming environment is one way to reduce exposure to container vulnerabilities. Additionally, many container ecosystems include the ability to attest that a container and its dependencies are supplied by a trusted provider, and there are tools (e.g., Qualys [49], Anchore [50], etc.) designed to audit container contents that provide supply chain and software audit management for HPC applications. Containers, container runtimes, and container orchestrators all increase the security attack surface for HPC systems, but carefully implemented container environments may potentially improve the overall security posture. Vulnerable or poorly configured container runtimes or container orchestrators can lead to exploitable environments and, in some cases, even privilege

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.6 (NIST 3.2.6)?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case:

3.2.6 Physical Security of the Cybersecurity Policy.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Workforce Framework for Cybersecurity (NICE Framework):

| Purpose and Applicability................................................................................
3              |
|                                                                                | 1.3                                                                                | Audience......................................................................................................... 3      |
|                                                                                | 1.4                                                                                | Organization of this Publication ...................................................................... 3                |
| 2                                                                                | NICE Framework Building Blocks ........................................................................4                 | NICE Framework Building Blocks ........................................................................4                 |
|                                                                                | 2.1                                                                                | Task Statements.............................................................................................

Workforce Framework for Cybersecurity (NICE Framework)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to PIV Data Model Test Guidelines:

3.1.1  Verify presence mmetric digital signature of CMS SignedData asy

| Purpose            | Con EFF_SIGNATURE_BLOCK is implemented as a firms that the CB SignedData type and is encoded as a Cryptographic Message Syntax external digital signature as defined in RFC 3852                                                                                |
|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Reference(s)       | 1. 3.1.10 Verify ne distinguished name

| Purpose      | C i e pivSigner- D t certifi at signed the biometrics. 3.1.11 Verify FASC-N

| Purpose      | Confirms that the signedAttrs of the SignerInfo includes the pivFASC-N attribute whose value matches the value of the FASC-N in the CHUID of the PIV card.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Metrics and Methodology for Hardware Security Constructs:

This document builds on that analysis to introduce a comprehensive methodology for analyzing various attack strategies that exploit vulnerabilities. The approach quantifies the sensitivity of hardware weaknesses by measuring the number of attack methodologies that can exploit them. An additional metric assesses the threat level of potential attacks based on the number of weaknesses they can target. Designed to be scalable and adaptable, this methodology can evolve with emerging attack patterns and hardware vulnerabilities to support the development of more secure future hardware designs while aiding in the identification and mitigation of vulnerabilities in existing systems.

Given the evolving nature of hardware security, new weaknesses and attack strategies will inevitably emerge. This work emphasizes the importance of continuously updating and expanding the analysis, and the methodology's robust design allows for seamless modifications. While this work focuses on hardware weaknesses, the methodology is applicable to all identified vulnerabilities, including those that may arise in the future. As such, the findings contribute to a growing body of knowledge to help mitigate existing vulnerabilities and guide the development of more secure hardware architectures. Ongoing research will be crucial in supporting decision-making and design considerations for security-resilient hardware.

Metrics and Methodology for Hardware Security Constructs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop provide? (Part 5)

[Assistant]
1.2 Background For The Federal                                                                                | Profile...............................................................
1                                                        |
|                                                                                | 1.3 About the IoT Federal Profile Virtual                                                                                | Workshop.............................................. 2                                                                        |
| 2 Event Summary and Key Takeaways ...................................................................4                          | 2 Event Summary and Key Takeaways ...................................................................4                          | 2 Event Summary and Key Takeaways ...................................................................4                          |
|                                                                                | 2.1 Keynote: Federal Chief Information Security                                                                                | Officer....................................... 4                                                                                |
| 2.2                                                                                | Summary and Takeaways from Panel                                                                                | Sessions.............................................

Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION ..................................................................................
7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19
3.2   DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23
3.3   CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS ..................................................................................... 32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

Cloud-native applications have evolved into a standardized architecture consisting of multiple loosely coupled components called microservices (often typically implemented as containers) that are supported by an infrastructure for providing application services, such as service mesh. Both of these components are usually hosted on a container orchestration and resource management platform. In this architecture, the entire set of source code involved in the application environment can be divided into five code types: 1) application code (which embodies the application logic), 2) application services code (for services such as session establishment, network connection, etc.), 3) infrastructure as code (for provisioning and configuring computing, networking, and storage resources), 4) policy as code (for defining runtime policies such as zero trust expressed as a declarative code), 5) and observability as code (for the continuous monitoring of an application runtime state). Due to security, business competitiveness, and the inherent structure of loosely coupled application components, this class of applications needs a different development, deployment, and runtime paradigm. DevSecOps (consisting of acronyms for Development, Security, and Operations, respectively) has been found to be a facilitating paradigm for these applications with primitives such as continuous integration, continuous delivery, and continuous deployment (CI/CD) pipelines. These pipelines are workflows for taking the developer's source code through various stages, such as building, testing, packaging, deployment, and operations supported by automated tools with feedback mechanisms. The objective of this document is to provide guidance for the implementation of DevSecOps primitives for cloud-native applications with the architecture and code types described above. The benefits of this approach for high security assurance and for enabling continuous authority to operate (C-ATO) are also discussed.

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Computer Security Division 2005 Annual Report:

mmunity. - Methods for assessing effectiveness of security  requirements -  SP  800-53A, Guide for Assessing the Security Controls in Federal Information Systems (first public draft issued July 2005).
- Procedures  for  capturing  results  of security  requirement  assessments  and results of security program assessments - SP 800-26 Revision 1, Guide for Information  Security  Program  Assessments  and System  Reporting  Form (first  public  draft issued August 2005). - Bring  the  security  planning  process  up to  date  with  key  standards  and  guidelines  developed  by  NIST -  SP  800-18 Revision 1, Guide for Developing Security Plans  for  Federal  Information  Systems (first public draft issued August 2005). - Provide  assistance  to  Agencies  and private sector - Conduct ongoing, substantial  reimbursable  and  non-reimbursable assistance support, including many outreach efforts  such  as  the  Federal  Information Systems  Security  Educators'  Association (FISSEA), the  Federal  Computer  Security Program  Managers'  Forum  (FCSM  Forum), the Small Business Corner, and the Program Review  for  Information  Security  Management Assistance (PRISMA). - Evaluate security policies and technologies from the private sector and national  security  systems  for  potential Federal  agency  use -  Host  a  growing repository  of  Federal  agency  security  practices, public/private  security  practices, and security configuration checklists for IT products. In conjunction with the Government  of  Canada's  Communications Security Establishment, CSD leads the Cryptographic  Module  Validation  Program (CMVP). The  Common  Criteria  Evaluation and Validation  Scheme  (CCEVS)  and  CMVP facilitate  security  testing  of  IT  products usable by the Federal government. - Solicit recommendations of the Information Security and Privacy Advisory Board on draft standards and guidelines -  Solicit  recommendations  of the Board regularly at quarterly meetings.

Computer Security Division 2005 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Information Technology Security Services:

| 5.2.3 | Testing..........................................................................................................5-8 | | | 5.2.4 | Training ........................................................................................................5-9 | | 5.3 | Technical Security Services...................................................................................5-11 | Technical Security Services...................................................................................5-11 | | | 5.3.1 | Firewalls .....................................................................................................5-11 | | | 5.3.2 | Intrusion Detection .....................................................................................5-11 | | | 5.3.3 | Public Key Infrastructure ............................................................................5-12 | | Appendix A-REFERENCES.................................................................................................A-1 | Appendix A-REFERENCES.................................................................................................A-1 | Appendix A-REFERENCES.................................................................................................A-1 | | Appendix B-ACRONYM LIST..............................................................................................B-1 | Appendix B-ACRONYM LIST..............................................................................................B-1 | Appendix B-ACRONYM LIST..............................................................................................B-1 | | Appendix C-SERVICE AGREEMENT OUTLINE................................................................

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Attribute Considerations for Access Control Systems:

3.4.2                                                                                | Synchronization... 3.4.2 Synchronization

Synchronization of attribute  transmission  sequences  between  access  control  functions  must  be coordinated based on the sequence of the access control system's processing scheme or protocol such that the updates of attributes and their values will not result in faulty access control decisions.

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Configuration Management?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

|   1. | There is broad support for expanding the discussion of IoT products in NIST IR 8259 to make products more central to the IoT cybersecurity baseline and allow further exploration of the cybersecurity considerations of other IoT product components beyond the device. |
|------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|    2 | Many cybersecurity challenges are aggravated by the limited visibility each role in the IoT ecosystem (e.g., manufacturer, integrator, customer) has into the cybersecurity of the whole system . |
|    3 | Performing risk analysis for IoT products remains a challenge due to the potential for unintended use or unexpected environments of use. |
|    4 | In understanding the magnitude of a risk, it is important to understand the scale of the potential impact from a threat. |
|    5 | Communicating effectively throughout IoT pre-market and post-market activities involves bridging gaps between manufacturer knowledge and customer ability to use the information. |
|    6 | Transparency and traceability are foundational to maintaining product cybersecurity throughout the IoT product lifecycle. |
|    7 | Discussions throughout the workshop highlighted challenges in IoT product lifecycle management emphasizing IoT product risks, vulnerabilities, and evolving ecosystem demands. |

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity of Genomic Data provide? (Part 5)

[Assistant] ## Table of Contents | Introduction....................................................................................................................1 | Introduction....................................................................................................................1 | Introduction....................................................................................................................1 | |-------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| | | Cybersecurity and Privacy Concerns.........................................................................1 | | | | Document Scope and Goals......................................................................................2 | | | Background....................................................................................................................3 | Background....................................................................................................................3 | Background....................................................................................................................3 | | | Genomic Information Lifecycle | ..................................................................................3 | | | Next Generation Sequencing.....................................................................................4 | | | | Variant Calling | ...........................................................................................................4 | | | Genome Editing.........................................................................................................5 | | | | Direct-to-Consumer Testing.......................................................................................5 | | | | The Characteristics of Genomic Data........................................................................6 | | | | Balance Between Benefits and Risks for Uses of Genomic Information | ...................7 | | Challenges and Concerns Associated with Handling Genomic Information...........9 | Challenges and Concerns Associated with Handling Genomic Information...........9 | Challenges and Concerns Associated with Handling Genomic Information...........9 | | | Potential National Security Concerns ........................................................................9 | | | 3.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Proceedings of the Workshop of the Federal Criteria for Information Technology Security:

Although networking issues had been declared out of bounds during the opening plenary session, there was general consensus that plain text nansmission of passwords was too important a vulnerability to ignore. Networic monitoring hardware and software makes it very easy for passwords to be compromised. Users without private offices were identified as being vulnerable to password compromise.

Availability covers much more than security; availability is not a security service, according to GOSIP. Denial of service is only one type of threat Resource allocation is a duty of the system administrator. Fault management is not security management The TCB should be expanded to provide these services. The components of availability are containment, fault tolerance, robustness, and recovery. Customers take a holistic view; so should the FC.

Sentiment was expressed that many of the components in Chapter 4 of the Federal Criteria have been randomly put into a hierarchy. The structure may be related to the policy that a particular system implements and/or the type of threat addressed. Since the relative importance of threats will vary among environments, a hierarchy is not appropriate.

Proceedings of the Workshop of the Federal Criteria for Information Technology Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.1.4. 3.1.4.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Annual Report 2018_ NIST_ITL Cybersecurity Program:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

In Fiscal Year 2018, we received and worked on new cybersecurity-related assignments from Congress and the President. Those have led us to focus our attention on assisting small businesses, forging practical solutions to address security concerns raised by the Internet of Things, and updating our guidance on risk management and security controls for federal agencies and others. We also launched major new initiatives, including the development of a voluntary framework for privacy risk management, standards for

One thing has remained constant over the past decade: our commitment to cultivating trust in information and the technology that drives the development and handling of that information. This annual report focuses on some of NIST's most noteworthy cybersecurity achievements in 2018 and offers insights into our current priorities and strategies. For a more complete review of our work, check out our primary cybersecurity website. 2

Annual Report 2018_ NIST_ITL Cybersecurity Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Information Security Guide for Government Executives:

It is the vehicle for disseminating security information that the workforce, including managers, needs to do their jobs. These programs will ensure that personnel at all levels of the organization understand their information security responsibilities to properly use and protect the information resources entrusted to them. Awareness is a blended solution of activities that promotes security, establishes accountability, and informs the workforce of security news. Training strives to produce relevant and needed security knowledge and skills within the workforce. Training supports competency development and helps personnel understand and learn how to perform their security role. Education integrates all of the security skills and competencies of the various functional specialties into a common body of knowledge and adds a multidisciplinary study of concepts, issues, and principles (technological and social). NIST SP 800-50, Building an Information Technology Security Awareness and Training Program |
| Information Security Governance         | The purpose of information security governance is to ensure that agencies are proactively implementing appropriate information security controls to support their mission in a cost-effective manner, while managing evolving information security risks. Information security governance has its own set of requirements, challenges, activities, and types of possible structures. Information security governance also has a defining role in identifying key information security roles and responsibilities, and it influences information security policy development and oversight and ongoing monitoring activities.

Information Security Guide for Government Executives


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Security Assessment?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

assessment; assessment method; assessment object; assessment procedure; assurance; enhanced security requirement; enhanced security requirement assessment; Controlled Unclassified Information; coverage; CUI Registry; depth; Executive Order 13556; FISMA; NIST Special Publication 800-53; NIST Special Publication 800-53A; NIST Special Publication 800-171; NIST Special Publication 800-172; NIST Special Publication 800-172A; nonfederal organization; nonfederal system; security assessment; security control. | CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION.................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity:

Core areas of cybersecurity standardization include: cryptographic techniques; cyber incident management; identity and access management; IT system security evaluation; information security management systems; network security; security automation and continuous monitoring; supply chain risk management; software | Core Areas of Cybersecurity Standardization | Examples of Relevant SDOs | Examples of Some Key Applications | Examples of Some Key Applications | Examples of Some Key Applications | Examples of Some Key Applications | Examples of Some Key Applications | Examples of Some Key Applications | |-----------------------------------------------|--------------------------------------------------------------------------|-------------------------------------|-------------------------------------|-------------------------------------|-------------------------------------|-------------------------------------|-------------------------------------| | Core Areas of Cybersecurity Standardization | Examples of Relevant SDOs | Cloud Computing | Emergency Management | Industrial Control Systems | Health IT | Smart Grid | Voting | | Cryptographic Techniques | IEEE ISO TC 68 ISO/IEC JTC 1 W3C | Standards Mostly Available | Some Standards Available | Some Standards Available | Some Standards Available | Some Standards Available | Some Standards Available | | Cyber Incident Management | ISO/IEC JTC 1 ITU-T PCI | Some Standards Available | New Standards Needed | Some Standards Available | Some Standards Available | Some Standards Available | New Standards Needed | | Identity and Access Management | FIDO Alliance IETF; OASIS OIDF ISO/IEC JTC 1

Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Minimum Security Requirements for Federal Information and Information Systems:

stems; and (ii) employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational information systems.
NATIONAL SECURITY SYSTEM: Any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency- (i) the function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions (excluding a system that is to be used for routine administrative and business applications, for example, payroll, finance, logistics, and personnel management applications); or (ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy. [44 U.S.C., SEC. 3542]

Minimum Security Requirements for Federal Information and Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Information System Security Best Practices for UOCAVA-Supporting Systems:

Jurisdictions that want to be able to validate signed email from military personnel need to install the trust anchor for the US Department of Defense Root CA.  This certificate can currently be found at

Some of the more intensive training programs can lead to certification for the trainee. There are a variety of certifications for security personnel from various independent organizations, and each certification has its own level of value and appropriateness for particular tasks. Some of the many types of security certifications include proof of skills such as:

Information System Security Best Practices for UOCAVA-Supporting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to Integrating Forensic Techniques into Incident Response:

es ............................................................................... | 8. Using Data from Multiple Sources ...............................................................................
| 8-1                                                                                |
| 8.1                                                                                | Suspected Network Service Worm                                                                                | 8-1                                                                                |
| 8.2                                                                                | Threatening E-mail................................................................................................ | Infection.......................................................... 8-3                                                                                |
| 8.3                                                                                | Recommendations                                                                                | ................................................................................................

Guide to Integrating Forensic Techniques into Incident Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to Integrating Forensic Techniques into Incident Response:

may be limited or missing. If the software was configured to forward copies of its logs to centralized log servers, then queries to those servers may provide some information. - ! Antivirus Software.
Because the threat reached the server and successfully breached it, it is unlikely that network or host-based antivirus software contains any record of the threat. If antivirus software had detected the worm, it should have stopped it. However, it is possible that the antivirus software saw the worm but somehow failed to stop it, or that the antivirus software was updated since the infection with new signatures that can recognize the worm. The incident handler can also scan the server for worms using a current version of antivirus software from a forensic toolkit. - ! Application Logs. If the worm used a common application protocol, such as HTTP or SMTP, information regarding it might be recorded in several places, such as application server logs, proxy servers, and application-specific security controls. Less common application protocols probably have information only in the application server logs. Application logs record extensive details on the application-specific characteristics of the activity, and are particularly helpful at identifying attack characteristics from less common applications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-55v2

## Measurement Guide for Information Security

Volume 2 - Developing an Information Security Measurement Program

Katherine Schroeder Hung Trinh Victoria Yan Pillitteri

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-55v2

<!-- image -->

## NIST Special Publication 800 NIST SP 800-55v2

## Measurement Guide for Information Security

Volume 2 - Developing an Information Security Measurement Program

Katherine Schroeder Hung Trinh

Victoria Yan Pillitteri

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-55v2

December 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. accordance with its assigned statutory responsibilities. The information in this publication, including concepts and

There may be references in this publication to other publications currently under development by NIST in methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

............................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................
| 5                                                                                |
| 2.2 ORGANIZATIONANDSTRUCTURE                                                                                | ............................................................................................. 7                                                  |
| 2.3 FLEXIBLE APPLICATION                                                                                | ............................................................................................................. 9                                  |
| CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11                       |
| 3.1 ACCESSCONTROL                                                                                | .................................................................................................................. 12                            |
| 3.2 AWARENESSANDTRAINING                                                                                | ...................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0:

mplemented outside of the information technology with an example counter-measure being physical protections such as locked offices and guarded buildings and an example attack being social engineering.
| Name       | Policy                                                                                | Discussion                                                                                |
|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| P.PHYSICAL | The processing resources of the TOE that must be physically protected in order to ensure that security objectives are met will be located within controlled access facilities that mitigate unauthorized, physical access. | A TOE will not be able to meet its security requirements unless at least a minimum degree of physical security is provided.

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Managing Information Security Risk_ Organization, Mission, and Information System View:

on-wide. Those same vulnerabilities may trigger changes to the enterprise architecture and embedded information security architecture or may require an adjustment to the organizational risk tolerance.
Section 2.5 provides a more detailed description of the specific activities associated with Tier 3.

Managing Information Security Risk_ Organization, Mission, and Information System View


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

-  A method to identify opportunities for improving the current cybersecurity posture of the manufacturing system -  An evaluation of their ability to operate the control environment at their acceptable risk level -  A standardized approach to preparing the cybersecurity plan for ongoing assurance of the manufacturing system's security | Function | Category | Subcategory | Manufacturing Profile | Reference | |------------|-------------------------|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------| | IDENTIFY | Governance (ID.GV) | ID.GV-4 | Low, Moderate and High Develop a comprehensive strategy to manage risk to manufacturing operations.

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.2.3. 3.2.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.5 (NIST 3.6.5)?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

3.6.5 | The attribute value is an X.

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data provide? (Part 3)

[Assistant]
e key software in that virtualized infrastructure. However, hypervisors are large  pieces  of  software  with  several  thousand  lines  of  code  and  are  therefore  known  to  have vulnerabilities.
Hence a capability to perform forensic analysis to detect, reconstruct and prevent attacks  based  on  recent  vulnerabilities  on  an  ongoing  basis  is  a  critical  requirement  in  cloud environments. The purpose of this document is to develop a methodology to enable this forensic analysis. Two  open-source  hypervisors-Xen and Kernel-based Virtual Machine (KVM)-were chosen as platforms  to  illustrate  the  methodology,  and  the  source  for  vulnerability  data  is  the National Institute of Standards and Technology's National Vulnerability Database (NIST-NVD). The vulnerabilities were classified in terms of hypervisor functionality, attack type, and attack source. Based  on  the  relative  distribution  of  vulnerabilities  in  a  hypervisor  functionality,  two sample attacks were launched to exploit vulnerabilities in the target hypervisor functionality, and the  associated  system  calls  were  logged. The  gaps  in  evidence  data  that  is  required  for  fully detecting and reconstructing those attacks are identified and techniques required to gather missing evidence are incorporated during subsequent attack runs. This is intended to be an iterative process. ## Keywords

cloud computing; forensic analysis; hypervisors; Kernel-based  Virtual  Machine  (KVM); vulnerabilities; Xen

## Acknowledgments

The authors thank Ms. Isabel Van Wyk for her valuable editorial review. ## Audience

The  target  audience  for  this  document  includes  security  staff  and  Chief  Information  Security Officers (CISO) in virtualized infrastructures used for enterprise computing needs or for offering cloud services. ## Trademark Information

All registered trademarks or trademarks belong to their respective organizations.

A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Obtaining Assurances for Digital Signature Applications:

1. a, b and c should be selected with regard to the judgments to be made about the validity of the digital signatures processed.  Consideration should also be given to the ease (or difficulty) of (repeatedly) using a given method to explicitly obtain assurance of possession.
2. A value of d shall be selected such that d is less than one half the minimum of a and b (i.e., d < ½ min ( a, b )). An interval of length d must allow sufficient time for the acquisition of time t 1, the actions required to provide/obtain assurance, and the

acquisition of time t 2. In particular, expected transmission times between various parties who must exchange information should be considered when selecting d .

Recommendation for Obtaining Assurances for Digital Signature Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Computer Security Division 2014 Annual Report:

|
| INTRODUCTION TO CSD'S FIVE GROUPS.....................................................................................................................................
| 3                                                                                |
| Cryptographic Technology Group (CTG)........................................................................................................................................................4                                 |                                                                                |
| Security Components and Mechanisms Group (SCMG).............................................................................................................................4                                                 |                                                                                |
| Secure Systems and Applications Group (SSAG)..........................................................................................................................................5                                       |                                                                                |
| Security Outreach and Integration Group (SOIG)........................................................................................................................................

Computer Security Division 2014 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Research Report_ User Perceptions of Smart Home Privacy and Security:

3.2.5                                                    | Household Profiling                                      | 16              |
|                                                          | 3. 3.2.5 Household Profiling

One of the concerns mentioned in the privacy context was the profiling of household members, including their pattern of life, what kinds of things they like, approximate ages of household members, and 'the literal movements of our family,.

Research Report_ User Perceptions of Smart Home Privacy and Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.3 (NIST 3.5.3)?

[Assistant]
According to Platform Firmware Resiliency Guidelines:

3.5.3                                                                                | Secure Local Update... 3.5.3 Secure Local Update

While this document recommends firmware updates be done through an authenticated update mechanism as described in Section 3. 3.5.3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

## 5.1 Integrity Techniques

- Integrity Techniques - Specify the approved integrity techniques or EDC [error detection code] employed

- Initiate on Demand - Specify how the operator can initiate the integrity test on demand

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines on Active Content and Mobile Code:

ine environment for systems and applications to execute. Risky functions, such as Web browsing, may be confined to a virtual machine environment designated and configured exclusively for that purpose.
This presumes that the virtualization software controlling the various virtual machine environments has adequate security [Gar07]. Should a virtual machine environment be compromised or become suspect, it can be replaced with the original version. Virtual machine technology is improving constantly. New versions of mainstream OSs are being designed with virtualization in mind and new x86 64-bit processors provide hardware-level support for virtualization.

Guidelines on Active Content and Mobile Code


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

- improvement opportunities for the organization's policies, plans, processes, procedures, and practices that support cybersecurity risk management to inform efforts under all six Functions. - PROTECT (PR) -Safeguards to manage the organization's cybersecurity risks are used. Once assets and risks are identified and prioritized, PROTECT supports the ability to secure those assets to prevent or lower the likelihood and impact of adverse cybersecurity events, as well as to increase the likelihood and impact of taking advantage of opportunities. Outcomes covered by this Function include identity management, authentication, and access control; awareness and training; data security; platform security (i.e., securing the hardware, software, and services of physical and virtual platforms); and the resilience of technology infrastructure. - DETECT (DE) -Possible cybersecurity attacks and compromises are found and analyzed. DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring. This Function supports successful incident response and recovery activities. - RESPOND (RS) -Actions regarding a detected cybersecurity incident are taken. RESPOND supports the ability to contain the effects of cybersecurity incidents. Outcomes within this Function cover incident management, analysis, mitigation, reporting, and communication. - RECOVER (RC) -Assets and operations affected by a cybersecurity incident are restored. RECOVER supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents and enable appropriate communication during recovery efforts. Figure 2 shows the CSF Functions as a wheel because all of the Functions relate to one another. For example, an organization will categorize assets under IDENTIFY and take steps to secure those assets under PROTECT.

The NIST Cybersecurity Framework (CSF) 2.0